From 3d7112e95089aabde940e3768ddd2802870221f6 Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 28 Jul 2026 07:44:19 +0000 Subject: [PATCH] security: dependabot fix-or-dismiss sweep Bump transitive js-yaml 4.x override 4.2.0 -> 4.3.0 (GHSA high, alert #11). Dev-only (eslint/@eslint/eslintrc, ^4.1.0). 3.x override stays 3.15.0. Lint + 248 tests green. Co-Authored-By: Claude Opus 4.8 --- package-lock.json | 6 +++--- package.json | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/package-lock.json b/package-lock.json index 06639fe..da579e1 100644 --- a/package-lock.json +++ b/package-lock.json @@ -3306,9 +3306,9 @@ "license": "MIT" }, "node_modules/js-yaml": { - "version": "4.2.0", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.2.0.tgz", - "integrity": "sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==", + "version": "4.3.0", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz", + "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==", "dev": true, "funding": [ { diff --git a/package.json b/package.json index b9646f1..6eb383f 100644 --- a/package.json +++ b/package.json @@ -20,7 +20,7 @@ }, "overrides": { "@babel/core": "^7.29.6", - "js-yaml@^4.1.0": "4.2.0", + "js-yaml@^4.1.0": "4.3.0", "js-yaml@^3.13.1": "3.15.0" } }